Cloud Computing (CC) Software as a Service

This Special Notice identifies GSA’s outline of requirements for NIST FIPS 199 defined Low and Moderate Impact Cloud Computing (CC) Software as a Service (SaaS) offering. Cloud Computing is a major initiative to modernize Information Technology (IT) within the Government. Cloud computing has the capability to reduce the cost of IT infrastructure using commercially available technology that is based on virtualization of servers, databases and applications to allow for capital cost savings. In anticipation of a possible issuance of an RFQ referring to Cloud Computing Software as a Service (SaaS), the following information is provided: In CC, security responsibilities are shared between the Contractor and the Consumer, in this case a Federal Government Agency. The Contractor will be responsible for provisioning, securing, monitoring, and maintaining the hardware, network(s), and software that support the infrastructure that is offered. In addition, the Contractor will be responsible for the security of the Operating System (OS) and any additional software (i.e., any data base management systems), including the applications provided. If individual (named) user access is required, the specific Service Level Agreement shall document who is responsible for creating and maintaining user accounts. The Service Level Agreements shall also document how the user accounts will be created and maintained. The implementation of a new Federal Government IT system requires a formal approval process known as Certification and Accreditation (C&A). NIST Special Publication 800-37, Revision 1, gives guidelines for performing the C&A process. At the Low and Moderate Impact levels, the Contractor must prepare and provide required documentation that describes the security mechanisms and processes used to maintain a secure environment. The contractor must also provide evidence of an independent assessment of these mechanisms, processes, and documents. Interested contractors should begin to prepare and accumulate relevant security artifacts as defined in NIST 800 series publications. THIS NOTICE IS NOT A REQUEST FOR COMPETITIVE PROPOSALS, IS NOT PURSUANT TO A REQUEST FOR PROPOSAL (RFP), NOR IS THE GSA OBLIGATED TO CONDUCT A COMPETITIVE PROCUREMENT. For more information, interested parties should E-mail [email protected] .